Arrest made in CRA 'Heartbleed' case: Police

Arrest made in CRA 'Heartbleed' case: Police

A 19-year-old man has been charged in connection with the loss of taxpayer data - including 900 social insurance numbers - from the Canada Revenue Agency website, the RCMP reported Wednesday.

Stephen Arthuro Solis-Reyes was arrested at his London, Ont. residence Tuesday and charged with unauthorized use of a computer and mischief in relation to data, the RCMP said. Police seized computer equipment from his home.

The CRA reported on Monday that 900 SINs had been stolen just before it shut down its website last Wednesday. The loss was detected last Friday, but the agency held off releasing the information to Canadians at the request of the RCMP, while it conducted an investigation.

The CRA, and several other government websites, shutdown online services - including the popular tax-filing systems E-FILE and NETFILE - due to the threat posed by the Internet encryption bug, Heartbleed, which affects OpenSSL software used by two-thirds of website providers to provide security and privacy to users.

The agency said it will notify those affected by the security breach by registered letter and offer free additional protection services. It has also extended the tax-filing deadline until May 5 due to the five-day service disruption.